MAL-2026-13151

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (81324df09668ea22833f1cff69d3e861bbb0644e5f231028ef2ea8ba0f9b8631) The package advertises itself as a UI toolkit, but its main entry require()s./_runtime.js, which on load downloads a platform-specific binary from author-controlled Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev), writes it to /var/tmp/.cache_<rand> or %TEMP%/dotnet_diag_<rand>.exe, chmods 0755, and spawns it detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true}).unref(). Host and domain strings are assembled at runtime from split-string arrays (e.g. ['sdk.dl.w','el1.r','u'].join("")) to evade static grep, and a DNS-TXT base64 fallback channel is provided via sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. Execution is gated on the absence of DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK and rate-limited via a /tmp/.analytics_state mtime stamp; comments frame the behavior as 'telemetry' cleanup. Filenames (.cache_*, dotnet_diag_*.exe) are chosen to blend into system tmp contents. The download-and-execute path has no relationship to the stated UI-toolkit purpose.